Temporarily encrypted user credentials

[Cantor, Scott]

> We're using Shibboleth IdP 3.2.0 and noticed what looks like a temporary
> encryption of user credentials in the session persistence backend.

There are no saved credentials under normal usage that I'm aware of.

> They seem to be reversibly encrypted using a time-bound id-aes128-gcm cipher,
> random initialization vector + current master key from JKS storage.

There are lots of things stored that way, but credentials aren't among them unless you choose to save passwords in the password login flow, in which case you've deliberately forced it to do that. If it's doing so otherwise, point it out, it's a bug (though they are encrypted, so it's not catastrophic, but we'll issue a patch).

-- Scott